An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances.
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
About this summary. This is a short excerpt from the description that SecurityWeek published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.securityweek.com/barracuda-email-security-gateway-authentication-bypass-opens-path-to-root/
Source attribution: headline and facts are from SecurityWeek (securityweek.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
OpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the Line
Rated Critical for cybersecurity, OpenAI’s new model beats GPT-5.6 Cyber at exploitation while staying in scope more reliably.
D-Link warns of multiple zero-days in DGS-3130 Series switches
D-Link shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches.
Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security…
Security certification is a snapshot, and buyers read too much into it
In this Help Net Security video, Mariia Bakhtina, a research specialist at Masaryk University, explains what a Common Criteria or FIPS-140 certificate does and does not…
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login…
CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Posted by Joerg Hoh on Nov 05 Severity: low Affected versions: - Apache Sling Engine before 3.0.4 Description: Inconsistent interpretation of HTTP requests ('HTTP…